PDF malware analysis — malicious · 2936f9d42e0e10eb

MALICIOUS

PDF

78.6 KB Created: 2021-02-27 07:49:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-14

MD5: bf3a800402c1e00a637ab4edcb1ff577 SHA-1: 843b253261a81448b62dfbe4e86b2135ea485c96 SHA-256: 2936f9d42e0e10eb6d22a43fe781a8312a3b525fa0bc649b064256e1e0ad0223

226 Risk Score

Malware Insights

MITRE ATT&CK

T1059 Command and Scripting Interpreter T1566.001 Spearphishing Attachment

This PDF document contains a large number of external links, many hosted on disposable domains, suggesting a link farm designed to distribute malware. The 'Clipboard command execution lure' heuristic indicates the document instructs users to copy and paste content into a shell, a common tactic for executing malicious commands. The ML classifier and ClamAV detection strongly support its malicious nature.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 7

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE

Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jumiwimov.ru/award?keyword=fios+router+g3100+specs PDF link annotation
- https://gevumonalibi.weebly.com/uploads/1/3/1/1/131164272/jutepaxos_weketupir.pdfIn PDF document text
- https://vesabigixovo.weebly.com/uploads/1/3/1/8/131857304/janukutanepuri.pdfIn PDF document text
- https://cdn.sqhk.co/refimadaraze/hfxjhuX/portal_gun_mod_for_minecraft_pe_ios.pdfIn PDF document text
- https://cdn.sqhk.co/luwukamuku/jaa4qKD/real_life_car_racing_videos_download.pdfIn PDF document text
- https://guvepilafofifiv.weebly.com/uploads/1/3/4/6/134682232/8796446.pdfIn PDF document text
- http://jotepuxigavof.iblogger.org/pejezewomamozokukirunofo.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4426059/normal_5ff23a38798da.pdfIn PDF document text
- https://cdn.sqhk.co/dadakafopina/cgeCihT/best_good_night_stickers_for_whatsapp.pdfIn PDF document text
- https://lizuxafemow.weebly.com/uploads/1/3/0/7/130776517/7663397.pdfIn PDF document text
- https://cdn.sqhk.co/tedefoso/7Ugd7Js/betikibibiridewexu.pdfIn PDF document text
- http://lujadexezusunam.22web.org/ytd_er_for_pc_free.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4453105/normal_60021a9bc7879.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4426955/normal_5fdc7b89bb56d.pdfIn PDF document text
- https://cdn.sqhk.co/nuvexajamu/jgfsjdL/rorawumitepevakuke.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4421366/normal_602db1145ee18.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://wojixefem.epizy.com/watercolor_brush_strokes_photoshop_free.pdfIn PDF document text
- http://purokazurawilew.rf.gd/migisur.pdfIn PDF document text
- http://tibimixokafif.epizy.com/15065531047.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e3f3.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE3F3	5172 bytes
SHA-256: `3dad79caa4cf0d24091f196bd62794b2adafa2031e149c766b59547907dfed64`
`font_01_sfnt_off0000f5b0.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF5B0	9916 bytes
SHA-256: `84dc688f13536f2b87147e69d383b30aaf5ac652f70ed49cf84d489520db6ea4`
`font_02_sfnt_off000117de.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x117DE	16088 bytes
SHA-256: `b2ddecaff7e2361bf51021b35f9c014659943b600c4f466cb4656cea9e83b80e`

Open this report in the interactive analyzer, or submit your own file for analysis.